A regulatory nightmare: Facebook and its goal of a less private Web

Facebook CEO Mark Zuckerberg listens to a question from the audience after unveiling a new messaging system during a news conference in San Francisco, California November 15, 2010.

ROBERT GALBRAITH/Robert Galbraith/Reuters

OMAR EL AKKAD and JACQUIE McNISH

March 26, 2017November 17, 2010

Chris Ye wants to know all about you and your friends. His business depends on it.

The co-founder of Uken Games, which develops software applications for social networks and mobile devices, is in his Toronto office sifting through information on the more than 100,000 people who play Superheroes and Villains, simplified adventure games his company has designed to for users of Facebook. Twice a day, he makes a point of studying their ages, genders, locations and friends to "get a pulse" on his customers.

The data - scraped from the massive store of information on which Facebook is built - has revealed to Mr. Ye and his team of seven employees a number of important insights. More than half of Uken's gamers are women. The most active players are men in their 40s. Without this data, Mr. Ye would never have been able to guess the profile of the players. More importantly, Mr. Ye knows his customers' friends - which means he knows precisely who his next potential customer is. What better motivation can there be for downloading an application on Facebook than knowing your pal is loving it?

Story continues below advertisement

On the Internet, information is power, and no company has more information than Facebook, which will likely eclipse Google soon as the world's most-visited website. Unlike Google, where users spend a few seconds or minutes searching for something and then move on, many of Facebook's 500-million users spend hours on the site every day. That shift - from a two-way street model of asking for and receiving information to a multidimensional set of interactions - has the potential to change the Internet in ways not seen since its popularization in the 1990s.

Imagine a future in which your social circle colours every on-line experience - in which websites customize content for you based on whom you know. In the not-too-distant future, an online shopping store's sales pitch to you may consist of a personalized pitch from one of your closest friends. A news website may present to you a strikingly different front page than it presents to anyone else, because its editors know from your Facebook profile that you like stories about politics, say, but not crime.

It's no longer far-fetched to imagine a Web where a users' every movement is a form of currency: walk down Robson Street in Vancouver and your mobile phone may light up with limited-time coupons to the restaurants closest to you. Announce the location of your wedding on your Facebook wall and, within minutes, the nearest caterers come calling.

But Silicon Valley's vision of a more open, more efficient, more personalized Web is the stuff of nightmares for privacy regulators. The battle between technology innovators and regulators will determine how quickly existing privacy boundaries can be redrawn to accommodate the ambitions of Web giants such as Facebook.

Canada can play a disproportionately large role in this tug of war because of its potent privacy laws and the work of its national Privacy Commissioner, Jennifer Stoddart. Since the small privacy regulator launched a pioneering investigation in 2009 into Facebook's practices, Canada has been at the forefront of one of the Web's most important issues.

CONTROVERSY IS A CONSTANT when Facebook innovates.

Ever since Mark Zuckerberg founded the social network's predecessor (Facemash, a site that showed photos of two Harvard students at a time and asked users to choose who was "hotter"), his handiwork has generated all kinds of backlash. The gamut runs from allegations of intellectual property theft to criticism that Facebook is cavalier about its users' privacy.

Story continues below advertisement

Story continues below advertisement

And yet, Facebook continues to thrive. And the more it grows, the more it pushes users to share.

Many of these changes arrive with no notice. When users logged on to Facebook on Nov. 6, 2007, they discovered the traditional feed of news from friends included alerts about some of their friends' Internet activities. If a friend had clicked a Facebook ad to buy a Playboy subscription or trip to Las Vegas, the news was shared with the social network. In Facebook's Palo Alto, Calif., laboratory, the innovation was seen as a service that deepened advertisers' connections with users.

Outside the lab, however, Facebook members were outraged. "The average user was told 'You must change.' There was no choice. The user felt pushed around," said Jules Polonetsky, co-chairman of Washington-based Future of Privacy Forum.

The controversy attracted the attention of Canada's small Privacy Commissioner after a local Internet advocacy group complained about Facebook's lax privacy safeguards. At the time, the commissioner's office was little known outside Canada, still reeling from a spending scandal under a previous administration.

After months of pushing Facebook for information, then-deputy commissioner Elizabeth Denham flew a small team to the company's Palo Alto headquarters to get some answers.

Ms. Denham declined to discuss the meeting, but people familiar with the session said Facebook vice-president Elliott Schrage and a group of company lawyers and staff met with the regulators in a large boardroom labelled The Canada Room. "You don't understand us," Mr. Schrage insisted. The company's users, he said, were not worried about privacy.

Story continues below advertisement

A spokeswoman for Facebook disputed that Mr. Schrage or others challenged the Canadian regulator. After "more that two years with constructive dialogue" with the commissioner, she said "it is clear that we share the same goals of ensuring people have control over their information."

Ms. Denham said that initially, Facebook appeared not to take her office seriously. "I think they thought we were this stodgy group of regulators in Canada with weak legal powers that couldn't do anything to them."

Facebook learned how serious the regulator was when the commission issued a report in July, 2009, that accused them of a number of privacy breaches. Most unsettling was a charge that Facebook was allowing application developers to temporarily scrape personal information, including names, e-mail addresses, birthdates, relationships and education history, every time a user clicked on a game or advertisement.

Although other Internet giants such as Google and Yahoo have quietly shared customer information for years with advertisers, none of it was as personal or as private as the Facebook treasure trove.

The commissioner's report grabbed headlines around the world, prompting Facebook to negotiate a settlement with the regulator. The company eventually overhauled its privacy settings and committed to the Canadian regulator that it would give users the right by August, 2010, to block app developers from storing personal information.

Initially, it appeared the privacy debate had been silenced. But Facebook fanned the flames again in April, 2010, when it unveiled Open Graph, a tool that allows people, in particular marketers and advertisers, to make use of Facebook's store of information about the connections between its users. One of the changes that came with Open Graph was a new policy that allowed application developers to store indefinitely any information they obtained from Facebook user accounts. Previously, the data had to be disposed after 24 hours.

"It was a step backwards," said Ms. Denham, who was recently appointed privacy commissioner for British Columbia. Later on, Facebook switched course again, committing to give users the option to prohibit application developers from capturing their information.

The Privacy Commissioner's experiences with Facebook have changed the way the regulator deals with privacy issues in the digital world. Against a business valued at tens of billions of dollars, the Canadian Privacy Commissioner has decided to team up with her colleagues around the world, in the hopes of speaking with a unified, amplified voice.

Indeed, this September, Canada took a leadership role in establishing the Global Privacy Enforcement Network, a union of 17 privacy offices around the world. Suddenly, Canada's tiny privacy regulator was at the forefront of global digital privacy issues.

TODAY, WHENEVER FACEBOOK INTRODUCES a new feature, it is careful to highlight all the associated privacy controls. When the social network introduced a geolocation service earlier this year that lets users tell their friends where they are, the majority of a Canadian media briefing consisted of instructions on how users can switch the service off.

It would seem Canada's privacy advocates have had a significant impact on the way the world's biggest social network does business. But on the other side of that coin is a massive impetus for Facebook to collect and utilize as much data as possible: to marketers, that personal data is worth billions of dollars.

Indeed, the average "Facebook fan" - that is, someone who endorses a company, a product or a cause by becoming a "fan" on Facebook - is worth $136.38, according to a research study by Syncapse, a Toronto-based social media technology and marketing firm. The company looked at Facebook fans of companies ranging from Coca-Cola to Gillette, to determine their value to the brand.

In 2006, Yahoo Inc. bid $900-million (U.S.) in an unsuccessful attempt to buy Facebook. Today, Facebook is worth more than $40-billion, according to a valuation derived from its trading price on a stock exchange for private companies. That's twice Yahoo's stock market value.

Virtually every major company in the world has a presence on the site. But while Facebook's current lure may be the sheer size of its user base, its long-term value is based on something much more subtle and significant: the social network's ability to influence - and to persuade users to part with reams of data about themselves, to reduce their own privacy.

That's the connection advertisers are ultimately willing to pay billions for, and no one else comes close to the sprawling global network of friends housed in Facebook.

Faced with the recent insurrection over privacy concerns, Mr. Zuckerberg is for the moment slowing Facebook's march toward a new, more open world.

In a rare video interview with The Wall Street Journal in June, Mr. Zuckerberg tried to mollify Facebook's concerned members. Sitting under the glare of television lights and faced with difficult questions about the company's privacy practices, he began to sweat profusely. After several minutes, he removed his trademark hoodie, revealing a corporate motto emblazoned on the lining that said: "Making the world open and connected."

Mr. Zuckerberg left little doubt that the company won't stop remaking the boundary lines of privacy.

"My prediction would be that a few years from now we'll look back and wonder why there was ever this time when all these websites and applications … weren't personalized in some way," he said.

"I just think that the world is moving in this direction where things are going to be designed more around people. I think that's really going to be a powerful direction."

We have closed comments on this story for legal reasons. For more information on our commenting policies and how our community-based moderation works, please read our Community Guidelines and our Terms and Conditions.